Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

[H-3] Owner Can Break Core Functionality

Author Revealed upon completion

Root + Impact

Owner Can Break Core Functionality via Gas Limit Updates in WeatherNft.

Impact: High severity—disrupts minting and updates, affecting all users.

Description

The WeatherNft.sol contract allows the owner to update Chainlink Functions and Automation gas limits via updateFunctionsGasLimit and updateKeeperGaslimit. Setting these to very low values (e.g., 0) causes Chainlink requests to fail, halting NFT minting (requestMintWeatherNFT) and weather updates (performUpkeep).

function updateFunctionsGasLimit(uint32 newGaslimit) external onlyOwner {
//@> Start of root cause
s_functionsConfig.gasLimit = newGaslimit;
//@> End of root cause
}
​
function updateKeeperGaslimit(uint32 newGaslimit) external onlyOwner {
//@> Start of root cause
s_upkeepGaslimit = newGaslimit;
//@> End of root cause
}

Risk

Likelihood:

  • The owner accidentally or maliciously sets s_functionsConfig.gasLimit or s_upkeepGaslimit to 0.

  • A compromised owner account is used to call these functions with invalid values.

Impact:

  • Chainlink Functions requests fail, preventing NFT minting and weather updates.

  • Users cannot mint new NFTs or keep existing ones updated, breaking core functionality.

Proof of Concept

// Scenario: Owner sets gas limit to 0
function testGasLimitBreak() external {
WeatherNft(weatherNftAddress).updateFunctionsGasLimit(0);
// User tries to mint NFT
WeatherNft(weatherNftAddress).requestMintWeatherNFT{value: 0.1 ether}(
"12345", "US", false, 0, 0
);
// Result: Chainlink Functions request fails due to insufficient gas
}

  1. Scenario: Owner sets gas limit to 0

  2. User tries to mint NFT

  3. Result: Chainlink Functions request fails due to insufficient gas

Recommended Mitigation

After adding the MIN gas limit constant variables, make sure to add the requirements at the functions necessary.

+ uint32 public constant MIN_FUNCTIONS_GAS_LIMIT = 300000;
+ uint32 public constant MIN_KEEPER_GAS_LIMIT = 200000;
function updateFunctionsGasLimit(uint32 newGaslimit) external onlyOwner {
+ require(newGaslimit >= MIN_FUNCTIONS_GAS_LIMIT, "Gas limit too low");
s_functionsConfig.gasLimit = newGaslimit;
}
​
function updateKeeperGaslimit(uint32 newGaslimit) external onlyOwner {
+ require(newGaslimit >= MIN_KEEPER_GAS_LIMIT, "Gas limit too low");
s_upkeepGaslimit = newGaslimit;
}
Updates

Appeal created

bube Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.